the security of an information domain will not be breached. In the overall lifecycle cost of the
SNC, the extra cost of the redundancy will be relatively low.
are not required.
main increase in risk comes from design and implementation failure, but there is also a
possibility that single hardware failures might compromise security.
resistance to long-term key storage, and to session key generation. This option might be useful
when the SNC is operated in a relatively safe physical environment, and the likelihood of
physical attack is reduced. The design can employ the same technology used in identification
tokens. Essentially, an embedded identity token carries the SNC’s keys and certificates - its
identity - and performs key generation and authentication for each session.
user. For example, a remote telemetry computer might process sensor data before forwarding it
to a central location. It might be useful to run untrusted software on the remote computer, while
still being assured that there would be no uncontrolled access to the information domain.
the tunnel to the remote enclave would require only a single authentication - for the computer
itself, rather than for both computer and user. This eliminates the need for a user i/o device.
vulnerabilities, are no longer required.